Disclaimer: The opinions expressed by our writers are their own and do not represent the views of U.Today. The financial and market information provided on U.Today is intended for informational purposes only. U.Today is not liable for any financial losses incurred while trading cryptocurrencies. Conduct your own research by contacting financial experts before making any investment decisions. We believe that all content is accurate as of the date of publication, but certain offers mentioned may no longer be available.
The dormant wallets of one of this year's largest crypto heists are moving again. Blockchain trackers Onchain Lens and Lookonchain have recorded a mass withdrawal of Ethereum stolen this spring from the decentralized platform Drift Protocol, based on Arkham data.
After two months of complete silence, the attackers activated the addresses under their control and began methodically transferring assets to the Tornado Cash mixer. "Dirty" ether is hitting the market, withdrawn in portions to avoid sharp swings in the exchange rate and to avoid drawing excessive attention to the final dumping points.
Over the past day, an address controlled by the hackers, labeled by analysts as Drift Exploiter 5, transferred 13,400 ETH to the mixer's contracts, equivalent to approximately $32 million. A number of analytics platforms, including MistTrack, estimate the total daily activity across related wallets even higher, at up to 25,700 ETH ($61.5 million).
The attackers are using the classic tactic of controlled obfuscation, sending funds in tranches of exactly 100 ETH. This breaks the direct link between sender and recipient in the public ledger, making further automatic tracking impossible.
The current transactions are the second major laundering attempt: in July, the hackers withdrew about $44 million through the mixer in a similar manner. Meanwhile, most of the loot remains untouched, with between 82,000 and 94,000 ETH, worth up to $224 million, accumulated in the attackers' balances.
Six months for trust, 12 minutes for the heist: the hack that made it into the textbooks
The assets now dissolving into the shadow sector of DeFi were stolen on April 1, 2026, when the Solana-based exchange Drift Protocol was drained of $285 million in just 12 minutes. This incident has made it into cybersecurity textbooks because of its unprecedented level of preparation.
According to TRM Labs and Chainalysis, the attack was carried out by the North Korean state-sponsored group UNC4736, also known as Citrine Sleet. The scheme unfolded over six months: the hackers posed as a legitimate venture fund, personally communicated with developers at international conferences, and deposited $1 million of their own funds into the exchange's pools to create a flawless alibi.
Later, through hidden vulnerabilities in Cursor and VSCode, they compromised the devices of the platform's Security Council members and intercepted admin keys. The final touch was the release of a fake CarbonVote token, which the attackers used as fictitious collateral to withdraw real reserves.
For the affected Drift investors, the appearance of Ethereum in mixers means a definitive loss of any chance of getting their funds back. In August, law enforcement managed to intercept and freeze only about $9.2 million, but the integration of the bulk of the capital into Tornado Cash makes any further seizure legally and technically impossible.
The exchange itself is trying to save its reputation: a compensation program using DFX tokens was launched on October 1. However, at this stage, the buyback fund, formed with Tether's support, covers only about 1% of users' net losses.
The team expects to replenish it with the platform's future revenues while the stolen millions are gradually distributed among new owners on the open market.